open-matrix

Repositories

1

Projects Packages

@open-matrix/credential-plane (1.1.32)

Published 2026-10-24 11:04:42 +00:00 by hivecast-admin

Installation

Setup this registry in your project .npmrc file:

@open-matrix:registry=

To install the package using npm, run the following command:

npm install @open-matrix/credential-plane@1.1.32

or add it to the package.json file:

"@open-matrix/credential-plane": "1.1.32"

For more information on the npm registry, see the documentation.

About this package

Credential Plane

Pure permission planning, attenuation and local credential minting for runtime and delegated identities. Runtime plans combine owned mounts, declared service-import surfaces and explicit platform role grants. Subject vocabulary comes from @open-matrix/subjects.

Hosted authority delivery permissions live in src/hosted-authority-subjects.ts. The platform Registry runtime may fan Registry and notification changes out to a home's event subject. System owners can receive notification events in their own account; tenant runtimes do not receive cross-home event permissions. Declared service-import mounts supply the corresponding request and event import surfaces.

The alert path is split into exact declared capabilities for evaluation, Needs You reconciliation, and the central notification owner's canonical tenant-fact lookup. That lookup arrives through an exact account import beneath the Notifications runtime's owned subtree. Credential planning grants only the one-tenant-token alert-source alias pattern, never a tenant Health inbox or authority subtree.

Planning these permissions does not modify already-issued credentials. Run pnpm test for permission regression tests and pnpm typecheck for type checking.

New runtime user JWTs also carry broker-signed NATS tags for the runtime id and each actor subtree in their typed runtime scope. Service and delegated credentials do not carry those tags, and previously issued credentials remain valid until their existing expiry.

The fleet.agent-workstreams capability grants the exact Blackboard request inbox for declared workstream observations. It grants neither wildcard transport nor dispatch authority.

Dependencies

Dependencies

ID	Version
@open-matrix/contracts	1.1.32
@open-matrix/subjects	1.1.32
nkeys.js	^1.1.0

Development Dependencies

ID	Version
@types/node	^20.0.0
typescript	5.9.3

Details

npm

2026-10-24 11:04:42 +00:00

0

UNLICENSED

71 KiB

Assets (1)

credential-plane-1.1.32.tgz 71 KiB

Versions (16) View all

1.1.33 2026-10-24

1.1.32 2026-10-24

1.1.2 2026-09-22

1.1.1 2026-09-22

0.1.14 2026-09-22